# CVE-2026-64849 — mlflow

**CISA KEV**

> As of 2026-10-02, CVE-2026-64849 is a CRITICAL-severity vulnerability in mlflow, CVSS v3.1 9.3, EPSS 9.8% (95.4th percentile). It is listed in the CISA Known Exploited Vulnerabilities catalog (added 2026-08-19), with a US federal remediation deadline of 2026-09-02. Threadlinqs Intelligence links 1 tracked threat campaign to CVE-2026-64849, most recently “CVE-2026-64849 — MLflow Server-Side Request Forgery (SSRF) Vulnerability in Model Registry Webhooks”.

**Last updated:** 2026-10-02

## What is CVE-2026-64849?

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0, the unauthenticated POST /api/2.0/mlflow/webhooks/{id}/test endpoint calls _validate_webhook_url() in mlflow/utils/validation.py only for the original URL while mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the validated address, allowing attackers to reach internal or cloud metadata services and receive response_status and response_body. This issue is fixed in version 3.15.0.

The record classifies CVE-2026-64849 under weakness class [CWE-918](https://intel.threadlinqs.com/cwe/CWE-918). Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 72 days ago.

## Severity and exploitation probability

- **CVSS v3.1 base score:** 9.3 — CRITICAL (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N`)
- **EPSS (FIRST):** 9.8% probability of exploitation in the next 30 days, higher than 95.4% of all scored CVEs
- **CISA KEV:** Listed since 2026-08-19, federal remediation deadline 2026-09-02
- **Threadlinqs priority:** 9/10 — CISA KEV-listed, which Threadlinqs floors at 9
- **Published:** 2026-08-17, last modified 2026-10-02

## Is CVE-2026-64849 being exploited?

CISA added CVE-2026-64849 to the Known Exploited Vulnerabilities catalog on 2026-08-19, which means the agency holds evidence of exploitation in the wild; US federal civilian agencies had to remediate it by 2026-09-02 under BOD 22-01. Weaponised exploit code for CVE-2026-64849 is publicly available. 5 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (`http/cves/2026/CVE-2026-64849.yaml`). It currently carries a trending score of 65 in the Threadlinqs vulnerability feed.

- [codeb0ssx/CVE-2026-64849-PoC](https://github.com/codeb0ssx/CVE-2026-64849-PoC) (github)
- [BiuTrap/CVE-2026-64849](https://github.com/BiuTrap/CVE-2026-64849) (github)
- [zavisco/CVE-2026-64849.yaml](https://github.com/zavisco/CVE-2026-64849.yaml) (github)
- [isaca0315/CVE-2026-64849-poc-lab](https://github.com/isaca0315/CVE-2026-64849-poc-lab) (github)
- [trickest/cve](https://github.com/trickest/cve/blob/main/2026/CVE-2026-64849.md) (trickest)

## Affected products and versions

- [mlflow](https://intel.threadlinqs.com/vendors/mlflow): mlflow

Affected software packages:

- `pip:mlflow` — patched in 3.15.0

## How to fix CVE-2026-64849

The record marks a vendor fix as available for CVE-2026-64849. Fixed versions are recorded for 1 package: pip:mlflow 3.15.0. Patch reference: [https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939](https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939). Vendor advisory: [https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j](https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j). Because CVE-2026-64849 is KEV-listed, US federal civilian agencies were required to apply the vendor fix, or stop using the product, by 2026-09-02. Apply the vendor fix referenced above to every affected product listed in this record, then confirm the running version against the vendor advisory.

## Threat activity tracking CVE-2026-64849

1 tracked threat in the Threadlinqs corpus references CVE-2026-64849, either in the campaign’s CVE list or as an indicator on the campaign record.

- [CVE-2026-64849 — MLflow Server-Side Request Forgery (SSRF) Vulnerability in Model Registry Webhooks](https://intel.threadlinqs.com/threat/TL-2026-2077) — CRITICAL · 2026-08-19

## Sources

Enriched from CVE.org, NVD, FIRST EPSS, CISA KEV, GitHub Security Advisories, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on 2026-10-10. This product uses the NVD API but is not endorsed or certified by the NVD.

**Vendor advisory and patch**

- [github.com](https://github.com/mlflow/mlflow/security/advisories/GHSA-7gwp-5pfp-969j)

**Other references**

- [github.com](https://github.com/mlflow/mlflow/issues/24179)
- [github.com (24258)](https://github.com/mlflow/mlflow/pull/24258)
- [github.com (ba949522477cbd5915aa55d29b0cfad7d5ddf939)](https://github.com/mlflow/mlflow/commit/ba949522477cbd5915aa55d29b0cfad7d5ddf939)
- [github.com (v3.15)](https://github.com/mlflow/mlflow/releases/tag/v3.15.0)

Canonical: https://intel.threadlinqs.com/cve/CVE-2026-64849
Full detection coverage and IOCs for threats exploiting CVE-2026-64849 via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp